Security Bulletin: A vulnerability in Bouncy Castle affects IBM Rational Performance Tester (CVE-2020-26939)

Summary

IBM Rational Performance Tester is vulnerable to error inputs in OAEPEncoding, potentially allowing a remote attacker to exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.

Vulnerability Details

CVEID:CVE-2020-26939
**DESCRIPTION:**Legion of the Bouncy Castle BC and Legion of the Bouncy Castle BC-FJA could allow a remote attacker to obtain sensitive information, caused by observable differences in behavior to rrror inputs in org.bouncycastle.crypto.encodings.OAEPEncoding. By using the OAEP Decoder to send invalid ciphertext that decrypts to a short payload, a remote attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/191108 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Upgrading to version 10.1.2 is strongly recommended.

Workarounds and Mitigations

None